容器安全基础：非 root 运行与只读文件系统

FROM node:18-alpine
RUN adduser -D app
USER app
WORKDIR /app
COPY . .
CMD ["node", "server.js"]

# docker-compose
services:
  web:
    image: myapp
    read_only: true
    tmpfs:
      - /tmp